I don't think you're doing anything wrong. I suspect that commons.wikimedia.org is not on the list of sites that are currently whitelisted for iframes. The devs have to maintain that list because iframes from untrusted sites can be used for bad things.

If you want to get that fixed, try filing a support request?